NPM PURLs are invalid (#832)

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

syft/pkg/dpkg_metadata_test.go

@@ -75,7 +75,7 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 				Version:       "v",
 				SourceVersion: "2.3",
 			},
-			expected: "pkg:deb/debian/p@v?upstream=s@2.3&distro=debian-11",
+			expected: "pkg:deb/debian/p@v?upstream=s%402.3&distro=debian-11",
 		},
 	}
 

syft/pkg/npm_package_json_metadata_test.go

@@ -1,18 +1,21 @@
 package pkg
 
 import (
+	"fmt"
+	"testing"
+
 	"github.com/anchore/packageurl-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
 func TestNpmPackageJSONMetadata_PackageURL(t *testing.T) {
 
 	tests := []struct {
-		name     string
-		metadata NpmPackageJSONMetadata
-		expected string
+		name      string
+		metadata  NpmPackageJSONMetadata
+		expected  string
+		namespace string
 	}{
 		{
 			name: "no namespace",
@@ -24,19 +27,36 @@ func TestNpmPackageJSONMetadata_PackageURL(t *testing.T) {
 		},
 		{
 			name: "split by namespace",
+			metadata: NpmPackageJSONMetadata{
+				Name:    "npmcli/arborist",
+				Version: "2.6.2",
+			},
+			expected:  "pkg:npm/npmcli/arborist@2.6.2",
+			namespace: "npmcli",
+		},
+		{
+			name: "encoding @ symobl",
 			metadata: NpmPackageJSONMetadata{
 				Name:    "@npmcli/arborist",
 				Version: "2.6.2",
 			},
-			expected: "pkg:npm/@npmcli/arborist@2.6.2",
+			expected:  "pkg:npm/%40npmcli/arborist@2.6.2",
+			namespace: "@npmcli",
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			actual := tt.metadata.PackageURL(nil)
 			assert.Equal(t, tt.expected, actual)
-			_, err := packageurl.FromString(actual)
+			decoded, err := packageurl.FromString(actual)
 			require.NoError(t, err)
+			assert.Equal(t, tt.namespace, decoded.Namespace)
+			if decoded.Namespace != "" {
+				assert.Equal(t, tt.metadata.Name, fmt.Sprintf("%s/%s", decoded.Namespace, decoded.Name))
+			} else {
+				assert.Equal(t, tt.metadata.Name, decoded.Name)
+			}
+			assert.Equal(t, tt.metadata.Version, decoded.Version)
 		})
 	}
 }

syft/pkg/python_package_metadata_test.go

@@ -27,7 +27,7 @@ func TestPythonPackageMetadata_pURL(t *testing.T) {
 					CommitID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 				},
 			},
-			expected: "pkg:pypi/name@v0.1.0?vcs_url=git+https:%2F%2Fgithub.com%2Ftest%2Ftest.git@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			expected: "pkg:pypi/name@v0.1.0?vcs_url=git+https://github.com/test/test.git%40aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 		},
 		{
 			name: "should not respond to release info",

syft/pkg/url.go

@@ -50,8 +50,13 @@ func URL(p Package, release *linux.Release) string {
 		fields := re.Split(p.Name, -1)
 		namespace = fields[0]
 		name = strings.TrimPrefix(p.Name, namespace+"/")
+	case p.Type == NpmPkg:
+		fields := strings.SplitN(p.Name, "/", 2)
+		if len(fields) > 1 {
+			namespace = fields[0]
+			name = fields[1]
+		}
 	}
-
 	// generate a purl from the package data
 	return packageurl.NewPackageURL(
 		purlType,